IN THE UNITED STATES DISTRICT COURT 
FOR THE EASTERN DISTRICT OF TENNESSEE 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH E- 
MAIL ADDRESSES 
karim.mastergroup@gmail.com; 
rak.mgusa@gmail.com; 
rahim.mgusa@gmail.com; 
kmsadruddin@gmail.com; 
rak.tmd@gmail.com; and 
kms.mastergroup@gmail.com 
THAT ARE STORED AT PREMISES 
CONTROLLED BY SERVICE PROVIDER 
GOOGLE LLC 


Case No. 1 i 1 ~ ^ \ ^ ^ 0 

Filed Under Seal 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Lars E. Schvartz, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for 

information associated with the following Google email (Gmail) accounts; 

karim.mastergroup@gmail.com, rak.mgusa@gmail.com, rahim.mgusa@gmail.com, 

kmsadruddin@gmail.com, rak.tmd@gmail.com and kms.mastergroup@gmail.com. These 

accounts are stored at a premises controlled by Google LLC, an e-mail provider headquartered at 

1600 Amphitheatre Parkway, Mountain View, CA 94043. The information to be searched is 

described in the following paragraphs and in Attachment A. This affidavit is made in support of 

an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 

2703(c)(1)(A), as well as Rule 41 of the Federal Rules of Criminal Procedure, to require Google 

LLC to disclose to the government copies of the information (including the content of 

communications) further described in Section I of Attachment B. Upon receipt of the 
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information described in Section I of Attachment B, government-authorized persons will review 
that information to locate the items described in Section II of Attachment B. 

2. I am a Special Agent with the Department of Homeland Security (DHS), Office of 
the Inspector General (OIG) and have been since November of 2017. Further, I was previously a 
Special Agent with the United States Secret Service (USSS) from March of 2007 through 
November 2017. I am currently assigned to the DHS OIG Major Frauds and Corruption Unit in 
Washington, D.C. and my duties include proactively identifying and investigating fraud schemes 
and/or corrupt activities that pose significant risk and major financial impact to DHS. 

3. I have completed the Criminal Investigator Training Program (CITP) at the 
Federal Law Enforcement Training Center (FLETC), Glynco, Georgia, and the USSS Special 
Agent Training Course in Beltsville, Maryland. My training included several investigative 
courses specifically dealing with financial crimes and related fraud schemes to include training 
in the enforcement of laws pertaining to financial crimes as found in Title 18 of the United States 
Code. 

4. I have been a Certified Fraud Examiner (CFE) since April of 2012. As such, I am 
required to maintain my certification through aimual fraud-related training and coursework. 

5. The following information is based on my own personal observations and 
knowledge, as well as information provided by Agents/Investigators from the Federal Bureau of 
Investigation (FBI), the Tennessee Bureau of Investigation (TBI), and the Tennessee 
Comptroller of the Treasury (TCOT); and from documents and sources noted herein. This 
affidavit does not contain all of the information known to law enforcement regarding this 
investigation. This affidavit is intended to show merely that there is sufficient probable cause for 
the requested warrant and does not set forth all of my knowledge about this matter. 
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6. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that violations of Title 18 USC § 1040, Fraud in Connection 
with a Major Disaster, Title 18 USC § 1343, Fraud By Wire, and Title 18 USC § 371,Conspiracy 
to commit an offense or to defraud United States, have been committed by Karim Sadruddin 
(karim.mastergroup@gmail.com, kmsadruddin@gmail.com, kms.mastergroup@gmail.com) and 
Rahim Sadruddin, a.k.a. Rahim Ali (rak.mgusa@gmail.com, rahim.mgusa@gmail.com, 
rak.tmd@gmail.com) in coimection with their employment with Master Group USA, LLC 
(MGUSA), and Textile Corporation of America LLC (TCA), 303 Perimeter Center North, Suite 
373, Atlanta, GA. There is also probable cause to search the infonnation described in 
Attaclunent A for emails related to the initiation and proliferation of these crimes further 
described in Attachment B. 

PROBABLE CAUSE CONCERNING FRAUD 

7. To date this investigation has determined that Karim Sadruddin and Rahim 
Sadruddin, representing both MGUSA and TCA, have perpetuated fraud against the federal 
government and the state of Tennessee. Through the use of fraudulent documentation (to include 
falsified wire receipts), Karim and Rahim Sadruddin, while representing MGUSA, were awarded 
a firm-fixed $30.7 million contract on November 9, 2017 with the Federal Emergency 
Management Agency (FEMA) to deliver 475,000 self-help tarps to victims affected by the 2017 
hurricanes. Ultimately, MGUSA provided FEMA with tarps that violated Country of Origin 
requirements specified by the contract under the Trade Agreements Act (TAA) and further 
violated the contract by delivering tarps that did not meet the manufacturing specifications as 
outlined in the Statement of Work (SOW). In furtherance of the above, the Sadruddins, through 
MGUSA and TCA fraudulently misused approximately $1,400,000.00 of a $3,000,000.00 
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Tennessee economic development grant to source and facilitate the purchase of FEMA tarps as 
described below. 

8. From November 23, 2017 through January 25, 2018, FEMA received and took 
delivery of 58,324 tarps from MGUSA and subsequently paid MGUSA a total of $3,774,895.76 
before suspending the contract to review product origin and specifications. 

9. On November 23, 2017, MGUSA, following up on a request from FEMA to 
prove product origin', emailed shipping and billing documents to FEMA from 
rak.mgusa@gmail.com, claiming that the initial shipment of tarps was manufactured and loaded 
in Taipei, Taiwan and necessarily shipped to Shanghai, China at a cost of $33,136.00. 
Subsequently, DHS OIG determined, through the use of physical and database searches, that the 
shipping/logistics company identified by name and address on the documents does not exist at 
the California addresses listed on the documents, nor is it believed to be a registered company in 
the state of California; as such, the shipping documents are believed to be fraudulent. 

10. On March 8, 2018, MGUSA emailed FEMA from rak.mgusa@gmail.com and 
provided several documents to include MGUSA Purchase Orders and Regions Bank Wire 
Transfer Receipts from MGUSA account ending in 7570. These documents were submitted for 
the purpose of proving MGUSA’s compliance with contractual requirements, specifically that 
the tarps meet TAA compliance. As a result of DHS OIG subpoenas, DHS OIG investigators 
determined that MGUSA provided FEMA with a fraudulent wire receipt from Regions Bank, 
dated November 13, 2017, in the amount of $33,136.00. MGUSA had submitted the wire receipt 


^ Product origin is germane to the FEMA contract as the contract requires adherence to the FAR 52.225-5 Trade Agreements Act (TAA). The 
TAA delineates designated countries that the U.S. Government has approved trade agreements with for the purpose of procuring goods and 
services to fulfill government contracts. Accordingly, by signing the contract, MGUSA agreed to provide tarps only from countries that were 
TAA designated, which precluded MGUSA from obtaining tarps from China. 
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as proof the company paid to transport tarps from Taiwan, the alleged place of origin, to 
Shanghai, China as a means of shipping expediency. DHS OIG reviewed the 
Regions Bank subpoena results and determined that the aforementioned amount was never wired 
from the account specified on the submitted wire receipt and appeared fraudulent. 

11. Moreover, upon review of the Federal Input Message Accountability Data (FED 
IMAD) reference number listed on the wire receipt, DHS OIG learned from Regions Bank that 
the number matched information from an actual MGUSA wire transfer processed by Regions 
Bank on February 13, 2018 in the amount of $552,474.00 funded to Mushtaq Ramzan Trading 
LLC, Dubai, United Arab Emirates. 

12. On April 19, 2018, DHS OIG detennined that a letter issued to FEMA by fonuer 
Gildan Co. employee, Tom Bruss on behalf of MGUSA was determined to be fraudulent. 
MGUSA submitted the letter to FEMA as part of its Technical Proposal for the purpose of 
supporting its credibility and viability as a contractor capable of delivering tarps manufactured 
by Gildan at a facility in the TAA designated country of Honduras. According to Gildan 
attorneys, Gildan was not aware of the letter at the time of its submission to FEMA and 
accordingly, the letter was never approved by company management or counsel and was deemed 
fraudulent. Further, Gildan Co. voluntarily provided DHS OIG with emails from the corporate 
Outlook account of Bruss. A review of these emails revealed communication between Karim 
Sadruddin (karim.mastergroup@gmail.com) and Bruss, demonstrating knowledge that China 
would possibly be used to manufacture tarps sold to FEMA. 

13. On January 29, 2018 and again on May 1, 2018, DHS OIG requested and received 
confirmation from Google LLC that a preservation request for content and non-content related 
data associated with gmail.com accounts karim.mastergroup@gmail.com and 
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rak.mgusa@gmail.com was obtained. In general, an e-mail that is sent to Google LLC’s 
subscriber is stored in the subscriber’s “mail box” on Google LLC’s servers until the subscriber 
deletes the e-mail. If the subscriber does not delete the message, the message can remain on 
Google LLC’s servers indefinitely. Even if the subscriber deletes the e-mail, it may continue to 
be available on Google LLC’s servers for a certain period. 

14. On June 27, 2018, the affiant became aware of a separate investigation of the 
Sadruddins being conducted in Tennessee by the FBI, TBI, and TCOT regarding fraud involving 
a grant issued by the State of Tennessee’s Department of Economic and Community 
Development (ECD). The Tennessee grant fraud investigation began in June 2018 based on 
information provided by a Confidential Human Source (CHS) to the FBI. The Affiant has met 
with the Agents/Investigators working on this grant fraud investigation, and they provided me 
with information and records regarding the fraud. 

15. According to the CHS, the Sadruddins perpetrated fraud involving the $3 million 
grant from ECD for the purchase and renovation of the “Dura” building in Pikeville, Tennessee. 
Cagle Development was hired to do the renovation work on the building. Karim Sadruddin 
submitted a fictitious Cagle Development invoice and a fictitious Regions Bank wire transfer 
record in order to fraudulently obtain a $1,406,000 reimbursement check from the grant funds for 
renovation work allegedly completed on the building. As of the date of the alleged Cagle 
Development invoice, the work reflected on the invoice had not been completed. A second 
Cagle Development invoice dated November 3, 2017, in the amount of $806,100 for work 
allegedly done on the building, was submitted by TCA to obtain additional grant funds, and this 
second invoice, according to the CHS, is also fraudulent. The CHS further provided infonnation 
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that Cagle Development has only received approximately $477,333 in total from the Sadmddin’s 
for the build-out/rehab of the building. 

16. In the spring of 2017, the Sadruddin’s proposed establishing a textile plant in 
Pikeville, Tennessee, and claimed that the operation would employ approximately 1,000 people. 
On May 9, 2017, TCA submitted a “Tennessee Application For Incentives” which BCD utilizes 
in determining eligibility for various state economic development programs. TCA’s application 
indicates that TCA was applying for a Fast Track Job Training Assistance Program and a Fast 
Track Economic Development Grant. The application was submitted by “Karim Sadruddin, 
Manager,” and it provides contact information for Karim Sadruddin and Rahim Ali, a.k.a. Rahim 
Sadruddin, including their email addresses ofkms.mastergroup@gmail.com and 
rak.tmd@gmail.com, respectively. 

17. In June 2017, BCD offered a $3 million Fast Track grant incentive package to the 
Bledsoe County Industrial Development Board (IDB), which in tum would disburse the grant 
funds to TCA. The $3 million grant was to be used for the purchase and renovation of the “Dura” 
building located in the city of Pikeville, Bledsoe County, Tennessee, which TCA would use as its 
manufacturing facility. $850,000 was to be used for the purchase of the building, and the 
remaining funds were to be used for the renovation of the building. The IDB engaged the 
services of the Southeast Tennessee Development (SETD) to assist in administering the grant. 
Grant funds were not advanced to TCA for the purchase and renovation of the building. Instead, 
TCA had to buy the building with its own funds, or pay for an approved expense associated with 
the renovation of the building, and then submit a claim for reimbursement by providing an 
invoice and proof of payment. TCA engaged the CHS and the services of Cagle Development to 
assist with the initial purchase and subsequent renovation work on the building. 
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18. On August 1, 2017, Rahim Sadruddin called the Director of SETD and asked 
what a Fast Track contract and request for reimbursement looked like, and in response, the 
Director emailed an example of a contract and request for reimbursement. The Director sent the 
email to Karim Sadruddin (karim.mastergroup@gmail.com) and Rahim Sadruddin. 

19. On August 25, 2017, Rahim sent an email (rak.mgusa@gmail.com) to the 
Director of SETD asking to schedule a phone call to discuss how TCA was currently making 
payments to their general contractor and to be sure that exact records were being kept to turn in 
for reimbursement. During the Director’s subsequent telephone conversation with Karim and 
Rahim Sadruddin, they talked about the example which the Director had emailed to the 
Sadruddins on August D‘, and the Director explained to them that they had to submit invoices 
and proof of payment in order to get reimbursed. 

20. On October 3, 2017, Karim Sadruddin (karim.mastergroup@gmail.com) sent an 
email to a representative of SETD, the mayor of Bledsoe County, and Rahim Sadruddin 
(rak.mgusa@gamil.com), to which Karim Sadruddin attached an alleged Cagle Development 
invoice dated August 26, 2017, in the amount of $1,406,900, and a purported wire transfer record 
reflecting a transfer of $1,406,900 on September 14, 2017, from TCA’s account at Regions Bank 
ending in 7570 (7570 is associated the MGUSA Regions Bank account and is believed to be a 
typo associated with this document) to Cagle Development’s account at SunTrust Bank. The 
purported wire transfer record appears to be an email from Regions Bank 
(Do_Not_Reply@regions.com) to Karim Sadruddin (kmsadruddin@gmail.com) with the subject 
“Outgoing Funds Transfer Debit Information TRN 170914-008066.” (Regions Bank has since 
advised the Affiant that this email confirmation is fraudulent and that Regions Bank records do 
not show a wire for the aforementioned amount was processed). In his October 3, 2017, email. 
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Karim Sadruddin references the alleged invoice and wire transfer record by stating, in part, 
“Please see attached invoice and backup for the draw request... Please let us know when the 
funds will be released, we have a finance meeting this week and I would like to update everyone 
on where we stand.” 

21. On November 8, 2017, the IDB issued two checks to TCA in the amounts of 
$850,000 and $1,406,900. The $850,000 check was to reimburse TCA for the purchase of the 
building, and the $1,406,900 check was for reimbursement of expenses associated with the 
renovation of the building. The Mayor of Bledsoe County called Karim Sadruddin to inform him 
that the checks were ready, and Karim Sadruddin then drove from Atlanta to Pikeville, 
Tennessee, to pick up the checks. The following day, November 9*'’, the checks, totaling 
$2,256,900.00, were deposited to TCA’s bank account ending in 1663 at the Regions Bank 
branch in Suwanee, GA. The account balance at the time of deposit was five hundred dollars 
($500.00). 

22. On November 16, 2017 through November 20, 2017, a total of $483,480.00 was 
transferred from TCA Regions Bank account ending in 1663 to MGUSA Regions Bank account 
ending in 7570. During this period, wires totaling $308,080.00 were paid to Korea Tarpai Co. 
Ltd, Red Rock Sourcing and Toyop Relief Pvt. Ltd. from the MGUSA account. These recipients 
are known to this Affiant as companies associated with the acquisition of tarps on behalf of 
MGUSA to fulfill the aforementioned FEMA contract. Thus, Karim Sadruddin’s October 3, 

2017, email referenced in paragraph (20) aided in the fraud perpetrated against FEMA, as well as 
the State of Tennessee; because the email resulted in the disbursement of grant funds to TCA, 
and a portion of these fraudulently obtained grant funds were then utilized by the Sadruddins to 
acquire tarps which the Sadruddins falsely claimed met TAA compliance. 
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23. On November 29, 2017, Karim Sadruddrin (karim.mastergroup@gmail.com) sent 
an email to a representative of SETD and Rahim Ali, a.k.a. Rahim Sadruddin 
(rak.mgusa@gmail.com), to which Karim Sadruddin attached an alleged Cagle Development 
invoice in the amount of $806,100 and a Domestic Wire Transfer Request/Authorization 
showing a transfer of $806,100 on November 15, 2017 from TCA’s account at Regions Bank 
ending in 1663 to Cagle Development’s account at SunTrust Bank. In the email, Karim 
Sadruddin stated, in part, “Please see attached the paperwork for the next draw for the work 
performed at the building. Please review and confirm. Please let me know when you think this 
can be funded?” According to Cagle Development records, the actual purpose of this $806,100 
was to repay the lender who had loaned TCA the money to purchase the Pikeville building, and 
not for the renovation of the building. 

24. On December 14, 2017 through January 3, 2018, a total of $1,038,824.35 was 
wired from TCA Regions Bank account ending in 1663 to tarp manufacturing sources: Qingdao 
Wins Shipping Co., Red Rock Sourcing, Richt International Inc., Success Kingdom Corp. and 
Korea Tarpia Co. Ltd. All of these companies are known to this affiant as businesses associated 
with or believed to be associated with the acquisition of tarps on behalf of MGUSA to fulfill the 
aforementioned FEMA contract. 

25. On January 5, 2018, the IDB wired $728,100 to TCA’s account at Regions Bank 
ending in 1663. This amount was less than the $806,100 wire record submitted by Karim 
Sadruddin for reimbursement because only $728,100 of the original $3 million in grant funds 
were still available for disbursement. 
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26. On January 16, 2018, a total of $353,936.05 was wired from TCA Regions Bank 
account ending in 1663 to Richt International Inc. and Qingdao Wins Shipping Co. It is 
believed that approximately $52,000.00 of tliis amount was directly attributable to the grant 
funds, as the remaining amount is believed to be from funds associated with FEMA 
receipts/payments to MGUSA. As stated previously, both companies are known to this Affiant as 
businesses believed to be associated with the acquisition of tarps on behalf of MGUSA to fulfill 
the aforementioned FEMA contract. Thus, the $728,100 wire transfer referenced in paragraph 
(25) aided in the fraud on FEMA, as well as the fraud on the State of Tennessee, because the 
fraudulently obtained funds were utilized, in part, by the Sadruddins to acquire tarps which the 
Sadruddins falsely claimed met TAA compliance. 

27. A review of both TCA and Cagle Development’s bank account records do not 
reflect the alleged wire transfer of $1,406,900 on September 14, 2017. Therefore, it appears that 
the wire transfer record submitted by Karim Sadruddin to obtain a reimbursement of $1,406,900 
in expenses associated with the renovation of the Pikeville building is, in fact, fraudulent. An 
investigator with TCOT has reviewed the bank records for accounts controlled by the 
Sadruddins, such as their personal accounts, TCA, and MGUSA. This review determined that a 
large portion of grant funds were diverted to pay for other expenses billed to TCA by Cagle 
Development, expenses which were incurred by the Sadruddins related to the operations of their 
other enterprises, specifically MGUSA, Textile Mill Direct, or to pay for personal expenses. As 
stated in paragraphs (22) and (26), a portion of the fraudulently obtained grant funds were 
utilized by the Sadruddins to acquire tarps for the FEMA contract. 

28. In May 2018, TCA and MGUSA initiated a lawsuit in the Chancery Court of 
Bledsoe County, Tennessee, against Edgar Cagle Jr. (the owner/operator of Cagle Development), 


Page 11 of 17 

Case l:18-mj-00100-SKL Document 2 Filed 10/18/18 Page 11 of 17 PagelD #: 12 


and others, regarding the Pikeville building. During the course of testimony related to this 
lawsuit, a MGUSA document was introduced which states, in part, that Cagle is “a rightful 
owner of 50% of MGUSA Shares.” The document appears to bear the signature of Karim 
Sadruddin who signed as “CEO,” and it reflects MGUSA’s address in Atlanta, as well as an 
email address of rahim.mgusa@gmail.com 

29. In summary, tlirough the use of subpoenas, interviews, and records analysis 
conducted by DHS OIG, the FBI, TBI, and TCOT; DHS OIG believes MGUSA & TCA have 
used the aforementioned email addresses as a means of communicating false documentation to 
further a scheme that simultaneously defrauded the United States government and the 
Tennessee’s Department of Economic and Conununity Development (ECD) through deception 
and false documentation by affecting FEMA to award a $30.7 million contract to MGUSA and 
causing ECD to advance grant funds for the reimbursement of expenses which TCA had 
allegedly incurred and paid to renovate the Pikeville building. 

BACKGROUND CONCERNING E-MAIL 
31. In my training and experience, I have learned that Google LLC provides a variety 
of on-line services, including electronic mail (“e-mail”) access, to the public. Google LLC 
allows subscribers to obtain e-mail accounts at the domain name “gmail.com,” like the e-mail 
accounts listed in Attachment A. Subscribers obtain an account by registering with Google LLC. 
During the registration process, Google LLC asks subscribers to provide basic personal 
information. Therefore, the computers of Google LLC are likely to contain stored electronic 
communications (including retrieved and un-retrieved e-mail for Google LLC subscribers) and 
information concerning subscribers and their use of Google LLC services, such as account access 
information, e-mail transaction information, and account application information. In my training 
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and experience, such information may constitute evidence of the crimes under investigation 
because the information can be used to identify the account’s user or users. 

32. In my training and experience, e-mail providers generally ask their subscribers to 
provide certain personal identifying information when registering for an e-mail account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and 
other identifiers, alternative e-mail addresses, and, for paying subscribers, means and source of 
payment (including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. 

33. In my training and experience, e-mail providers typically retain certain 
transactional information about the creation and use of each account on their systems. This 
information can include the date on which the account was created, the length of service, records 
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account 
(including whether the account is inactive or closed), the methods used to connect to the account 
(such as logging into the account via the provider’s website), and other log files that reflect usage 
of the account. In addition, e-mail providers often have records of the Internet Protocol address 
(“IP address”) used to register the account and the IP addresses associated with particular logins 
to the account. Because every device that coimects to the Intemet must use an IP address, IP 
address information can help to identify which computers or other devices were used to access 
the e-mail account. 

34. In my training and experience, in some cases, e-mail account users will 
communicate directly with an e-mail service provider about issues relating to the account, such 
as technical problems, billing inquiries, or complaints from other users. E-mail providers 
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typically retain records about such communications, including records of contacts between the 
user and the provider’s support services, as well records of any actions taken by the provider or 
user as a result of the communications, hi my training and experience, such information may 
constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. 


CONCLUSION 


35. Based on the forgoing, I request that the Court issue the proposed search warrant. 
Because the warrant will be served on Google LLC who will then compile the requested records 
at a time convenient to it, there exists reasonable cause to permit the execution of the requested 
warrant at any time in the day or night. 


REQUEST FOR SEALING 


36. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation that is neither public nor known to all of 
the targets of the investigation. Accordingly, there is good cause to seal these documents 
because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted, 



Special Agent - 

DHS — Office of the Inspector General 



,, 2018 


UNITED STATES MAGISTRATE JUDGE 
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ATTACHMENT A 


The email accounts to be searched are known active Gmail accounts assigned to Karim 
Sadruddin and Rahim Sadruddin, respectively karim.mastergroup@gmail.com and 
rak.mgusa@gmail.com. Per the System for Award Management (SAMS), these email accounts 
were provided as Mandatory Points of Contact and have been used throughout the term of this 
contract as a means of ongoing communication between FEMA and MGUSA. These email 
accounts, as well as, rahim.mgusa@gmail.com, kmsadruddin@gmail.com, rak.tmd@gmail.com 
and kms.mastergroup@gmail.com were also utilized by Karim and Rahim Sadruddin as a means 
of ongoing communication between Textile Corporation of America and state and local officials 
regarding the Dura/Pikeville building project. 
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ATTACHMENT B 


Particular Things to be Seized 

1. Information to be disclosed by Gmail LLC. (the “Provider”) 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider, including any emails, records, files, logs, or information that 
has been deleted but is still available to the Provider, the Provider is required to disclose the 
following information to the government for each account or identifier listed in Attachment A 
from January of 2017 through present date: 

a. The contents of all e-mails associated with the account, including stored or 
preserved copies of e-mails sent to and from the account, draft e-mails, the source and 
destination addresses associated with each e-mail, the date and time at which each e-mail was 
sent, and the size and length of each e-mail; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, records of session 
times and durations, the date on which the account was created, the length of service, the IP 
address used to register the account, log-in IP addresses associated with session times and dates, 
account status, alternative e-mail addresses provided during registration, methods of connecting, 
log files, and means and source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, and files; 

e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of actions taken. 
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II. Information to be seized by the government 

All information described above in Section I that constitutes evidence of violations of 18 
U.S.C. §§ 1040 & 371, those violations involving Karim and Rahim Sadruddin, including, for 
each account or identifier listed on Attachment A, information pertaining to the following 
matters: 

a. Discussions regarding FEMA, MGUSA, tarps, government contracts or grants. 
Textile Corporation of America, Ed Cagle, Cagle Development, the Dura/Pikeville building, or 
any associated contractors or sub-contractors; 

b. Contact information on individuals related to the discussions discovered above; 

c. Financial discussions or records regarding MGUSA, FEMA, Textile Corporation 
of America, Ed Cagle, Cagle Development, or associated partners, suppliers, contractors or sub¬ 
contractors; 

d. Discussions regarding financial relationships between Karim Sadruddin, Rahim 
Sadruddin, Bruss, Ed Cagle, Cagle Development, and any and all others involved with MGUSA, 
Textile Corporation of America, or their associates, known and unknown; 

e. Information relating to the development, submission, or communications 
concerning MGUSA’s Technical Proposal and/or records associated with other government 
contract proposals. Textile Corporation of America’s application for incentives, receipt and 
disbursement of grant or government contract proceeds; and 

f. Information concerning individuals associated with MGUSA, Textile Corporation 
of America, and any affiliated entities, to include their identities and/or whereabouts. 
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